PDA

View Full Version : Breakpoint on file

Anonymous
06-16-2003, 07:35 AM
Hello,

Is it possible to set a breakpoint whenever a file tries to open/access/close a file?

Thanks in advance!
Spud
06-16-2003, 08:06 AM
yes.

oh, you want to know how? Press ALT+F1 and type "bp CreateFileA".
Anonymous
06-16-2003, 08:24 AM
Nah, didn't wanna know how ;-)

But anyway: works great! I inmediately found where I was looking for!

And if someone feels like to answer another question: is it also possible for in the future to set a breakpoint on a particular filename? (and if so, how it is done ;-) )
(Maybe this is possible, cause I noticed that the filename is the first parameter in the call...)

Thanks again!
Anonymous
06-18-2003, 08:05 PM
Look before CreateFileA, it PUSHes variables onto the stack. If you look in WinAPI help file, the first parameter is the filename, in assembly, parameter order is reversed, so your last PUSH before CreateFileA is the address of the filename. In command line type d ADDRESS to see the string. Not sure if you can break point specifically on filename. You could use a script or some shit in softice.
Anonymous
06-19-2003, 01:56 PM
or you can use a conditional breakpoint on CreateFile APi. read the help
Anonymous
06-20-2003, 02:33 AM
I press Alt+F1 on olly debugger. it does nothing... any idea why?
Anonymous
06-20-2003, 03:49 AM
install the commandline plugin
Anonymous
07-14-2003, 12:17 PM
i need a breakpoint when the WORD in memory address at 12AE74 is equal to $FFFF

help help thx
Teerayoot
07-15-2003, 11:26 PM
easy,try it by your'self!

--- select on line to break( alway above createfileA )look memory reference
such as when you select line that $ffff is a arg---
push [dd ds+4b] now right click select bp -> contition bp ,in text box

fill [dd ds+4b]==a value that true ,ollydbg break
or [dd ds+4b]=="string" yeah,you can play with this for any api call.